ci-templates v2 contract: endpoint-free Flywheel and scaffold inheritance

[Jess Sullivan (Jesssullivan)]

Summary

Prepares tinyland-inc/ci-templates for the v2 spoke-conformance contract.

• makes bazelrc/flywheel.bazelrc endpoint-free and moves remote_cache / remote_executor authority into flywheel-bazel runtime env or inputs
• adds inherit-scaffold-skills so spokes can inherit plugins/scaffold-core, .agents/skills, and .claude/skills from a pinned site.scaffold tag
• adds repo-manifest-validate plus the vendored tinyland.repo.json schema and optional static-spoke role gating in spoke-ci.yml
• adds repo-local Justfile, flake.nix, flake.lock, tinyland.repo.json, and validation helper so ci-templates validates like consuming repos
• documents @v1 to @v2.0.0 migration, internal @v2 refs, endpoint discipline, and gitleaks local scanning

Why

This reduces per-spoke CI noise by putting the reusable contract in one place: ci-templates owns reusable workflows/composites, site.scaffold owns the agent/static-spoke contract, Blahaj owns PR lane/public preview dispatch, and GloriousFlywheel owns cache/RBE eligibility.

Validation

• just check
• nix develop --command just check

Both include YAML parsing, JSON/schema parsing, tinyland.repo.json validation, internal ci-template ref checks, endpoint-free Flywheel checks, and gitleaks working-tree scan.

Related

• tinyland-inc/site.scaffold#13
• TIN-1581